ETK-2026-2771Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2771",
  "cve_id": null,
  "display_id": "ETK-2026-2771",
  "ghsa_id": "GHSA-9m75-vc3g-4x39",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Quadratic-time ASN.1 string decoding in pyasn1",
  "summary": "pyasn1 versions through 0.6.4 can consume excessive CPU while decoding fragmented constructed ASN.1 string values or certain indefinite-length ANY values. An attacker may cause denial of service by supplying specially structured ASN.1 input to an application that passes untrusted data to affected decoder paths without adequate resource limits.",
  "mitigation": "Upgrade pyasn1 to version 0.6.5 or later. Until upgrades are complete, restrict untrusted ASN.1 input sizes and enforce decoding CPU or request-time limits.",
  "vendor": "pip",
  "product": "pip:pyasn1",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.6.4"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "0.6.5"
      ],
      "package_name": "pyasn1",
      "purl": "pkg:pypi/pyasn1"
    }
  ],
  "cwes": [
    407
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 26.995456,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T06:58:57+00:00",
      "days": -0.5238532663773148,
      "is_lower_bound": true,
      "measured_at": "2026-10-27T19:33:17.949083+00:00",
      "url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39"
    }
  }
}